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METHOD OF AND APPARATUS FOR REMOTE MONITORING 

FIELD OF THE INVENTION 

This invention relates to the field of network systems and, in particular, to 
remote monitoring of a computer system on a network. 

5 BACKGROUND 

The Internet may be described in a simplified manner as a collection of 
computer systems (e.g., clients and servers) that are interconnected by 
public/private networks (e.g., transmission lines and routers) to enable the 
transfer of information among them, as illustrated in Figure 1, These computer 

10 systems are often modeled by their function: client-server. In the client-server 
model, communication generally takes the form of a request from the client to 
the server asking for an operation to be performed (e.g., request for data). The 
server performs the work and sends a reply. A client may then retrieve and 
display the requested information. However, a computer system may operate as 

15 both a server and a client. 

Client-server systems communicate with each other using a variety of 
network protocols, such as Transmission Control Protocol/Internet Protocol 
(TCP/IP) and Integrated Packet Exchange (IPX), and a variety of application 
protocols, such as HyperText Transfer Protocol (HTTP) and File Transfer 

20 Protocol (FTP). A user typically views the Internet as a collection of web pages 
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that are typically located on a server at a network site. Each web page may 
contain text, embedded components such as graphic image files, and address 
links to other pages referred to as a Uniform Resource Locator (URL). Web 
pages are viewed using a program called a browser that resides on a user's client 
5 computer. The browser retrieves information from a requested page on a server, 
interprets the data and formatting commands, and displays the text and special 
accessory files, such as images, on the user's client system. 

Increased traffic on the Internet has resulted in performance problems 
with sites (systems and connections), such as reduced download speeds during 

10 periods of heavy loads (a measure of system activity). Businesses are faced with 
the increasing burden of monitoring and testing the performance of their sites on 
a real-time basis. For example, a business may rely on its on-line site to sell a 
product. If the business site, or a portion thereof (e.g., a web page or server), is 
not operating properly, orders for a product may not be able to be placed. This 

15 may result in a business suffering financial consequences. As such, a business 
has an interest to know if and when any portion of its site ceases to operate 
properly from its customer's point of view. 

The performance of a site and its computer systems may be measured in 
different ways. One measure of performance is the accessibility of the computer 

20 system through a backbone used to connect the computer system with an end 
user. A backbone, also referred to as an Autonomous System (AS) network, is a 
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set of transmission lines and hardware that a business site may be connected to 
for long distance communication. Another measure of performance is the 
amount of time it takes to retrieve and display the information to the user, 
referred to as download speed. 
5 One way to monitor and analyze a business site's performance is to 

measure performance on the server side (the computer system providing the 
pages requested by the user). One problem with such a method is that the 
performance experienced by a user may not be readily determined from 
measurements made from the server. For example, the speed with which a 

10 server delivers requested information may not correlate with the speed 
experienced on the client side by a user due to, for example, congested or 
downed transmission lines. 

Another way to monitor and analyze a site's performance is to perform 
client side measurements using an actual user's client system. For example, a 

15 user's client browser may be configured to record download speeds of particular 
transactions. Such performance information is stored on a client's system and 
then obtained from the user's system. One problem with such a method is that 
the performance information collected is based on user specific factors that may 
be uncontrollable and may not be common to other users. For example, a user 

20 running several simultaneous, high bandwidth downloads will typically 
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experience slower performance than a user on an identical client system with an 
identical browser who is running a single low bandwidth download. 

Another problem with client side measurements is that the collected 
performance information may be limited to only measuring the total load time of 
5 a web page and throughput (bytes of data sent over an end-to-end transaction 
time). The condition of the network connection to the client may not be included 
in the collected information. As such, allowances for these other factors may not 
be made when analyzing performance. 

Moreover, strictly load time and throughput measurements do not reflect 
10 the quality of the downloaded information. For example, if a server is non- 
operational, then requests to a web page on the server may return an error 
message response (e.g., "can't process request") very quickly. This would appear 
to be a period of exceptionally good download performance when, in fact, no 
content from the site was downloaded to the user. Therefore, such a method 
15 may not provide an accurate or detailed analysis of a site's performance that 
reflects a customer's true experience. 

Furthermore, prior methods of web site analysis use browsers that are 
very code intensive and operating systems that may not be very reliable. Such 
platforms may not be very scalable or robust and, thus, may not be desirable. 
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SUMMARY OF THE INVENTION 

The present invention pertains to a method of and apparatus for remote 
monitoring. In one embodiment, the apparatus may includes an intranetwork, 
an extranetwork coupled to the intranetwork, and a first host digital processing 

5 system coupled to the intranetwork with the first digital processing system has 
performance parameters. The first remote digital processing system may be 
coupled to the extranetwork to monitor a performance parameter of the first host 
digital processing system. 

In one embodiment, the method may include positioning a remote digital 

10 processing system on a backbone network remotely from a host digital 

processing system with the host digital system coupled to the backbone network 
through an intranetwork. The method may also include monitoring a 
performance parameter of the host digital processing system with the remote 
digital processing system. 

15 Additional features and advantages of the present invention will be 

apparent from the accompanying drawings and from the detailed description 
that follows. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention is illustrated by way of example, and not by way of 
limitation, in the figures of the accompanying drawings and in which: 

Figure 1 illustrates an internetwork architecture. 

Figure 2 illustrates one embodiment of a network site monitoring system. 
Figure 3 illustrates one embodiment of remote satellite systems coupled to 
an IP network. 

Figure 4 is a block diagram illustrating an exemplary architecture of a 
remote satellite monitoring system. 

Figure 5 illustrates one embodiment of a remote satellite system in the 
form of a digital processing system. 

Figure 6 illustrates an alternative embodiment of a network site 
monitoring system. 

Figure 7 A illustrates one embodiment of a method of remote monitoring. 

Figure 7B illustrates one embodiment of a configuration interface. 

Figure 8 illustrates one embodiment of a timing parameters measurement 
process. 

Figure 9 illustrates one embodiment of a parameters correctness 
verification process. 
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DETAILED DESCRIPTION 

In the following description, numerous specific details are set forth such 
as examples of specific systems, languages, components, etc. in order to provide 
a thorough understanding of the present invention. It will be apparent, 
5 however, to one skilled in the art that these specific details need not be employed 
to practice the present invention. In other instances, well known materials or 
methods have not been described in detail in order to avoid unnecessarily 
obscuring the present invention. 

The present invention includes various steps, which will be described 

10 below. The steps of the present invention may be performed by hardware 

components or may be embodied in machine-executable instructions, which may 
be used to cause a general-purpose or special-purpose processor programmed 
with the instructions to perform the steps. Alternatively, the steps may be 
performed by a combination of hardware and software. 

15 The present invention may be provided as a computer program product, 

or software, that may include a machine-readable medium having stored thereon 
instructions, which may be used to program a computer system (or other 
electronic devices) to perform a process according to the present invention. The 
machine-readable medium may include, but is not limited to, floppy diskettes, 

20 optical disks, CD-ROMs, and magneto-optical disks, ROMs, RAMs, EPROMs, 
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EEPROMs, magnet or optical cards, flash memory, or other type of media / 
machine-readable medium suitable for storing electronic instructions. 

Figure 2 illustrates one embodiment of a network site monitoring system. 
The network monitoring system 200 may include various hardware and software 

5 components to perform monitoring functions. The network monitoring system 
200 may include a business site 210, one or more remote satellite systems (e.g., 
remote satellite system 250) located remotely from business site 210, and a 
monitoring operations center (MOC) 230. Business site 210, remote satellite 
system 250 and MOC 230 may be coupled together via extranetwork 220, such as 

10 an Internet Protocol (IP) network. 

An IP network transmits data in the form of packets that include an 
address specifying the destination systems for which communication is intended. 
Business site 210, remote satellite system 250, and MOC 230 may communicate 
with each other using various protocols, for examples, HTTP, Telnet, NNTP, and 

15 FTP. Security layers for managing the security of data transmission may also 
reside between the application protocols and the lower protocol (TCP/IP) layers, 
for examples: Secure Sockets Layers (SSL). Alternatively, secure application 
protocols may be used, for examples, Secure HTTP (HTTPS) and Secure Shell 
(SSH). These various protocols are known in the art; accordingly, a detailed 

20 discussion is not provided herein. 
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In one embodiment, MOC 230 may be located remotely from business site 
210. Alternatively, MOC 230 may be located locally to or within business site 
210. It should be noted that local and remote designations do not necessarily 
refer to geographic relationships but, rather, to network relationships. 

5 Business site 210 may include one or more computer systems, or hosts, 

(e.g., hosts 211-213) connected together via intranetwork 215. Three hosts 211- 
213 are shown only for illustrative purposes. Business site 210 may have more or 
less than three hosts. Hosts 21 1-213 may be configured to perform as servers. In 
one embodiment, intranetwork 215 is a local area network (LAN). The local area 

10 network may be either a wired or wireless network. Alternatively, hosts 211-213 
may be coupled together using other types of networks, for example, a 
metropolitan areas network (MAN) or a wide area network (WAN) with various 
topologies and transmission mediums. 

A host (e.g., host 211) may be configured to provide various services for 

15 clients that are accessed through ports of the host connected to intranetwork 215. 
Types of network services include, for examples, electronic mail using a Simple 
Mail Transfer Protocol (SMTP), web page display using HTTP, news article 
distribution using a Network News Transfer Protocol (NNTP), fetching email 
from a remote mailbox using a Post Office Protocol-3 (POP3), and text file 

20 retrieval for viewer displaying using Gopher, etc. Each service may be 
configured on an industry standard port or on a custom port. If a service 
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operates with a custom port, then remote satellite system 250 may either be 
preprogrammed with the port information or perform probes to determine a 
port's configuration. 

For example, if host 211 is configured to operate as an HTTP server, 
5 remote satellite system 250 may attempt to establish a connection to industry 
standard TCP port 80 (or port 443 if HTTPS is used) to determine if it is 
connected to intranetwork 215. If no reply is received, then port 80 for that 
particular host 211 is either down or host 211 may be using a different port for 
the service. 

10 Figure 3 illustrates one embodiment of remote satellite systems coupled to 

an IP network. In one embodiment, one or more remote satellite systems (e.g., 
remote satellite systems 351-353) may be strategically positioned at different 
points on IP network 320 that are close to network backbones 321-324. Four 
network backbones are shown only for illustrative purposes. The network site 

15 monitoring system may include more or less than four backbones. Backbones 

are extranetworks that enable high-bandwidth communication, in particular long 
distance communication, between short range networks (e.g., local and regional 
area networks). Examples of backbones 321-324 include those provided by 
Sprint, AT&T, Exodus, and UUNET. 

20 Remote satellite systems 351-353 are positioned at points similar to those 

of expected users (e.g, user 340) of business site 310. In one embodiment, remote 
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satellite systems 351-353 may be positioned behind peering points between 
backbones. In another embodiment, remote satellite systems 351-353 may be 
positioned at geographically significant locations (e.g., countries, states, and 
cities from which users access network 320) or network-topographically 

5 significant locations (e.g., close to and far from business site's 310 server). Other 
strategies may be used to position remote satellite systems 351-353. For example, 
in another embodiment, remote satellite systems 351-353 may be positioned 
behind major Internet Service Provider (ISP) proxy servers or behind access 
points for the business users (e.g., large dial-up pools such as America On Line 

10 and Earthlink, cable ISP providers, DSL providers, ISDN providers, etc.) 

Remote satellite systems 351-353 may operate similar to a client system to 
interact with hosts of business site 310 in order to monitor and evaluate user 
interactions with the business site 310 hosts (i.e., the experience that a user of the 
business site will undergo). It should be noted that the remote satellite systems 

15 351-353 are not limited to directly accessing a host but may also access a host 
through another system such as a proxy server. 

Business site 310 may designate the URLs of one or more web pages to 
monitor and evaluate. In one embodiment, a business site may be able to pre-set 
cookies in the monitoring configuration to allow remote satellites 351-353 to 

20 access particular web pages. In general, a business site may serve information 
both in a stateless way (e.g., the corporate info page, a static page that is served 
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up the same way to every visitor on each visit) and in a stateful way (e.g., a 
user's account info page, where the information may change between users and 
between each visit of the same user, and where the system must first know some 
state before serving up information, particularly some user-identifying state 

5 information like a username). 

In one embodiment, to get the stateful information, a user usually goes 
through a fixed flow. For example, to get to an "Account Information" page, a 
user may first have to go through a "Login" page, then to a "Select Account" 
page. At each stage, the server must know where the user is in the process. That 

10 information may be maintained with cookies that are small portions of data 
stored on the client machine that are sent tot the server with information 
requests. Typically an unattended agent exercises this flow. The agent rims a 
monitoring script that posts authentication data, accepts the cookie, posts the 
account number, and then examines the final page. However, if the "Login" 

15 page is down, the other two pages may not be monitored. As such, by pre- 
setting a cookie with required state information, an unattended agent may verify 
the performance of each page independent of the other pages. 

Referring still to Figure 3, a web page may be configured to perform a 
particular type of transaction, for example, a purchase transaction. These URL 

20 addresses may be downloaded to remote satellite systems 351-353 or 

programmed directly into remote satellite systems 351-353. The remote satellite 
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systems 351-353 establish connections with the designated URL to perform 
transactions and report on the various system parameters and backbone 
conditions such as transaction times (e.g., connection time, download times, etc.) 
as discussed below. Because remote satellite systems 351-353 are connected to 

5 backbones 321-324 at points similar to that of a business site's 310 users (e.g., user 
340), remote satellite systems 351-353 may provide data relevant to the 
experience that similarly connected users experience. The remote satellite 
systems 351-353 collect this data for analysis and report generation. 

In one embodiment, the data is analyzed and a report is generated by the 

10 remote satellite systems 351-353 and transmitted to MOC 330, with the data also 
being transmitted if desired. Alternatively, the data may be transmitted to MOC 
330 with the analysis and report being generated at MOC 330. The information 
on remote satellite systems 351-353 may either be pushed or pulled across IP 
network 320 to MOC 330 for processing such as evaluation, notification, and 

15 reporting. The MOC 330 may then take corrective actions including notifying 
the business site of identified problems; rerouting network traffic; and/or 
contacting a backbone provider directly to fix problems. For example, if the 
access time monitored by remote satellite system 353 on backbone 322 is long 
relative to the time on backbones 321, 323, and 324, then traffic may be rerouted 

20 to the other backbones until the data collected by remote satellite system 353 
indicates that the problem has been fixed. 
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Figure 4 is a block diagram illustrating an exemplary architecture of a 
remote satellite monitoring system. In one embodiment, remote satellite 
monitoring system 400 may include a configuration file or database 410 for 
storing parameters for the different business sites that are monitored. The 

5 parameters provide a remote satellite system with the information needed to 
monitor a host, for examples, URLs to monitor, thresholds to alert on, 
authentication information for password-protected pages, data to upload, pre- 
defined cookies, and positive/negative search patterns, as discussed below. 
In one embodiment, the information stored in configuration file 410 is 

10 provided to configuration file reader 420 that reads the information from 

configuration file 410 and provides it to monitoring agent 425. In an alternative 
embodiment, monitoring agent 425 may read the configuration database directly. 

Once monitoring agent 425 has the configuration information, one or 
more of the following operations may be performed for each configured 

15 transaction. In one embodiment, timing analyzer 440 may be used to measure 
timing threshold parameters. Timing threshold parameters may include, for 
examples, domain name system (DNS) lookup time, connect time, latency, 
transfer rate, and throughput. Timing generator 430 is used to generate the 
timing signals required to measure the timing threshold parameters. 

20 In the addressing scheme of an IP network, an address comprises four 

number strings separated by dots. Each computer system on the network has a 
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unique address. For ease of use, names in the form of alphanumeric characters 
(e.g., recognizable words) may be mapped to a number string. The DNS is a 
hierarchical naming scheme and distributed database system for implementing a 
naming scheme for mapping computer system names to IP addresses. The DNS 

5 lookup time is the time it takes for a client system's browser (in this case the 

remote satellite system) to connect with a DNS database to translate the business 
site web page server's name (e.g., www.nocpulse.com ) into an IP address, before 
sending a request to the business site server. As such, connection agent 425 is 
used to establish a connection with a DNS database for a designated URL and 

10 then, subsequently, establish a connection with the designated URL. 

Once a connection with a particular URL is established, timing analyzer 
440 is used to record detailed timing statistics of a transaction. During the 
transaction, the connect time, latency, transfer rate, and throughput parameters 
may be measured. The connect time is the time it takes for a client system to 

15 send a request to establish a connection with a business server and receive a 
reply from the business server that a connection is established. 

Additional timing parameters such as latency may also be measured. 
Latency is the time between a client sending in a request for data and getting 
back the first byte of data. For example, for a credit card transaction, a user 

20 sends in data about his credit card (e.g., account name, credit card number, 
expiration date, etc.) and the items that he wishes to purchase to the business 
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site. The business site may then contact the credit card company, where some 
back-end processing is performed, to verify the user's credit. Only after this is 
complete will the business site transmit a confirmation to the user that the 
purchase transaction is complete. In this example, the request for data may be 
5 the request for acknowledgement of a completed transaction and the data sent 
back to the user is confirmation that the transaction has been successfully 
completed. As such, the transaction generator 440 performs steps similar to 
those that a user would perform to complete a desired transaction (e.g., a credit 
card transaction). 

10 The transfer rate is the network rate, or the bytes per second between the 

first byte and last byte of a particular response. Throughput is the time it takes 
(e.g., in bytes per second) for an entire session from DNS lookup to the last byte 
received by a client. 

The remote satellite system may also evaluate correctness parameters of 

15 the network connection to the business site using verifier 450. Verifier 450 may 
be part of a host program, a separate program on a remote satellite system, or a 
separate program on another system. Verifier 450 may include one or more 
verifiers to evaluate correctness parameters. For example, verifier 450 may 
include a content verifier, a subsidiary page (SUBS) verifier, and link verifier. 

20 The content verifier verifies the data according to the configuration, for 

examples, the size of the content, the format (HTML vs. XML vs. GIF, etc.), and 
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whether the content contains the correct information. Verifying the correctness 
of content may be performed by determining positive or negative search patterns 
on a particular web page. Search patterns may be literal strings such as ordered 
groups of characters (e.g., partial words, words, and phrases with or without 

5 spacing and punctuation) or regular expressions such as patterns of characters 
(e.g., one or more digits followed by a pound sign). Positive search patterns are 
patterns that must be found in the content for the content to be considered 
correct. Negative search patterns are patterns that must not be found in the 
content for the content to be considered correct. 

10 In one embodiment, the content may be passed off to a SUBS verifier 

which parses the content for subsidiary pages and tries to retrieve each 
subsidiary page. A subsidiary page contains data that is attached to a parent 
web page. As previously discussed, a web page may contain links to special 
accessory files (e.g., images, frames, background sounds, applets, etc.) that are 

15 automatically loaded by a client's browser in addition to the text. When a 

client's browser loads a web page that contains an image, for example, at least 
two transactions may be performed: an HTML transaction that loads the text of 
the web page and fetch transaction that retrieves the image file from its storage 
location. As such, evaluating the correctness of such a subsidiary page involves 

20 determining whether the content of the subsidiary page is available for retrieval. 
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In one embodiment, the content may be passed off to a links verifier. A 
web page may also contain links (i.e., strings of text containing IP addresses of 
other web pages) that a user can access by, for example, selecting the link with a 
cursor control device. The links verifier parses the content for links (e.g., HTML 

5 Anchor tags and hypertexts links) and makes a determination as to whether the 
content on a link is accessible. 

The output of verifier 450 is provided to queuing client 485 to store and 
queue collected data such as performance metrics (e.g., timing parameter 
statistics and correctness parameter checks) and alerts. Queuing client 485 may 

10 periodically transmit the collected data to results database 470 and/ or a 
notification system such as MOC 230 of Figure 2. The remote satellite 
monitoring system 400 may also include multiple queues for different types of 
data, for example, one queue for correctness parameters and one for timing 
parameters. A priority may be set for each of the queuing clients that 

15 determines the order in which data will be uploaded. 

The performance metrics may be provided to results database 470 either 
directly via queuing client 460 or by way of another interface where they are 
made available to report generator 460. Report generator 460 generates a report 
file 480 that contains information about the performance metrics. Reports 

20 generator 460 may generate reports automatically or on demand. A report may 
be, for example, a graph of the connect time over the previous three hours. In an 
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alternative embodiment, the data collected by remote monitoring system 400 
may be transmitted to a MOC, with the MOC performing report generation. 

It should be noted that although the monitoring and evaluating of a 
business site has been discussed at times in relation to an HTML protocol, 

5 systems operating with other types of protocols, for examples, FTP and Gopher 
may also be monitored and evaluated. 

Figure 5 illustrates one embodiment of a remote satellite system in the 
form of a digital processing system 500 representing an exemplary workstation, 
personal computer, server, etc., in which features of the present invention may 

10 be implemented. 

Digital processing system 500 includes a bus or other communication 
means 501 for communicating information, and a processing means such as 
processor 502 coupled with bus 501 for processing information. Processor 502 
may represent one or more processors such as a Motorola PowerPC processor or 

15 an Intel Pentium processor, etc. Digital processing system 500 further includes 
system memory 504 that may include a random access memory (RAM), or other 
dynamic storage device, coupled to bus 501 for storing information and 
instructions to be executed by processor 502. System memory 504 also may be 
used for storing temporary variables or other intermediate information during 

20 execution of instructions by processor 502. System memory 504 may also include 
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a read only memory (ROM) and /or other static storage device coupled to bus 
501 for storing static information and instructions for processor 502. 

A data storage device 507 such as a magnetic disk or optical disc and its 
corresponding drive may also be coupled to digital processing system 500 for 

5 storing information and instructions. The data storage device 507 may be used 
to store instructions for performing the steps discussed herein. Processor 502 
may be configured to execute the instructions for performing the steps discussed 
herein. In one embodiment, digital processing system 500 is configured to 
operate with a LINUX operating system stored on data storage device 507. In 

10 alternative embodiments, another operating system may be used, for examples, 
Windows NT and Solaris. 

In one embodiment, digital processing system 500 may also be coupled 
via bus 501 to a display device 521, such as a cathode ray tube (CRT) or Liquid 
Crystal Display (LCD), for displaying information to the user. For example, 

15 graphical and /or textual depictions/indications of system performance 

characteristics, and other data types and information may be presented to the 
system administrator on the display device 521. Typically, an alphanumeric 
input device 522, including alphanumeric and other keys, may be coupled to bus 
501 for communicating information and/ or command selections to processor 

20 502. Another type of user input device is cursor control 523, such as a mouse, a 
trackball, or cursor direction keys for communicating direction information and 
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command selections to processor 502 and for controlling cursor movement on 
display 521. 

A network interface device 525 is also coupled to bus 501. Depending 
upon the particular design environment implementation, the network interface 

5 device 525 may be an Ethernet card, token ring card, or other types of interfaces 
for providing a communication link to a backbone of an IP network for which 
digital processing system 500 is monitoring. 

It will be appreciated that the digital processing system 500 represents 
only one example of a system, which may have many different configurations 

10 and architectures, and which may be employed with the present invention. For 
example, some systems often have multiple buses, such as a peripheral bus, a 
dedicated cache bus, etc. 

In one embodiment, communication device 526 may also be coupled to 
bus 501. The communication device 526 may be a modem, or other well-known 

15 interface device, for providing a communication link to the MOC independent of 
the communication link to which network interface 525 is connected. In this 
manner, communication device 526 provides a backup link to a MOC if the 
primary link fails as illustrated by Figure 6. For example, remote satellite system 
650 may include a modem to enable communication via the Public Switched 

20 Telephone Network (PSTN) 625 with MOC 630 independent of the 

communication link through IP network 620. In an alternative embodiment, 
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other communication means (e.g., wireless) may be used to enable remote 
satellite system 650 communication with MOC 630 independent of IP network 
620. MOC 630 may include one or more digital processing systems similar to 
digital processing system 500 of Figure 5. 

5 Figure 7 A illustrates one embodiment of a method of remote monitoring. 

The method may include determining parameters to monitor, step 710. In one 
embodiment, the parameters may be configured by the business site through a 
configuration interface at the MOC and then downloaded by the MOC to one or 
more of the remote satellite systems. Alternatively, the configuration interface 

10 may reside at a remote satellite system. 

Figure 7B illustrates one embodiment of a configuration interface 760. The 
parameters may include for examples, the URL (the location of the desired 
information, including protocol, server, port, path, and optionally additional 
data) 761, authentication information 762, timing thresholds 763, notification 

15 configuration 764, features (e.g., check links) 765, pre-set cookie 767. In an 
alternative embodiment, these parameters may be supplied by a business site 
through other means and configured by the MOC, or determined by the MOC as 
discussed above. 

Referring again to Figure 7 A, a connection with a particular host (e.g., a 
20 URL address) is attempted, step 720, so that a transaction may be performed, 

step 725. In one embodiment, one or more timing parameters are measured, step 
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730. In an alternative embodiment, one or more correctness parameters may be 
evaluated, step 740. A determination is made if there are additional tansactions, 
step 755, and additional URLs are to be analyzed, step 750. If so, then steps 720- 
740 may be repeated. Once one or more URLs are analyzed, the collected 

5 parameter data is analyzed and the data is uploaded, step 760. 

Figure 8 illustrates one embodiment of a timing parameter measurement 
process. In one embodiment, a high resolution timer is started, step 810. Next, a 
DNS lookup may be performed and the lookup time calculated, step 815. After 
DNS lookup is complete, a connection with a particular URL address of a host 

10 system is established and the connect time calculated, step 820. Time may be 
calculated with either direct or relative timing measurements. 

The transaction request may be performed and the time of request 
recorded, step 825. Receipt of the first byte of the response is waited for and the 
latency calculated, step 830. When the last byte of data is received, the total time 

15 is recorded, step 835. The calculation of aggregate timing parameters may be 
performed, step 840, including data transfer rate and throughput. 

Figure 9 illustrates one embodiment of a parameters correctness 
verification process. In one embodiment, the parameter correctness verification 
process may include one or more of the following: verification of search strings 

20 910; verification of SUBS 930; and verification of links 950. 
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Content verification 910 may include selecting a positive search pattern or 
a negative search pattern, step 915; searching the content, step 920; and 
comparing the pattern with the searched content, step 925. In one embodiment, 
search patterns may be simple strings (i.e., ordered groups of characters), and 

5 step 925 may include determining if the search string occurs anywhere in the 
content. In another embodiment, search patterns may be regular expressions 
(e.g., three digits followed by a pound sign) and step 925 may include 
determining if any group of characters in the content satisfy the expression. The 
content is successfully verified if the pattern is a positive pattern and the pattern 

10 matches, or the pattern is a negative pattern and the pattern does not match. If 
there is additional content to be verified, step 926, the process may be repeated. 

Verification of SUBS 930 may include determining the existence of 
accessory files, step 935. The accessory files are fetched, step 940, and then 
examined to determine if the content of these files is available, step 945. For 

15 example, a web page may contain a link to an image file that is automatically 
loaded by a client's browser in addition to the text. As such, a fetch transaction 
may be performed to retrieves the image file from its storage location. If no 
image is retrieved then a determination may be made the content of the image 
file is not available for retrieval. The process may be recursive. For example, if 

20 page A contains subsidiary page B, and subsidiary page B contains its own 

subsidiary page C, then both B and C (and sub-subsidiary pages) are verified. If 
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there are additional subsidiary pages to be verified, step 946, the process may be 
repeated. 

Verification of links 950 may include determining the existence of a link, 
step 955, and following the link, step 960. Next, a determination may be made as 

5 to whether the link is accessible, step 965. In one embodiment, accessibility may 
include downloading the linked data and possibly doing one or more content 
checks (e.g., verify that the returned page is not empty). In another embodiment, 
following the link may include query the linked server to see if the linked data is 
available, but without actually downloading the data. Either embodiment, may 

10 be implemented by the link verifier directly, or the link verifier may drive an 
external program (e.g., monitoring client 431 of Figure 4). The process may be 
repeated for additional links, step 967. 

In one embodiment, the method and architecture discussed above may be 
implemented with an interpreter program. An interpreter is a language 

15 processor that analyzes a program and then carries out the specified actions 
(processes instructions) at the time of execution, rather than producing a 
machine-code translation to be executed later (as with a compiler). In one 
embodiment, the steps discussed above are coded using Perl. In an alternative 
embodiment, other programming languages may be used. 

20 The method and apparatus for remote monitoring of a business site as 

described above may provide valuable information about the business site. By 
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positioning the remote satellite systems at points near backbones approximate to 
those of clients accessing a business site, a more accurate analysis of a site's 
performance may be performed that better reflects an end user's true experience. 
In addition, by using dedicated remote satellite systems, consistent information 

5 about the performance of a business site may be collected independent of 

variations in an end user's client system hardware and software. Moreover, by 
measuring various timing threshold parameters and evaluating correctness 
parameters of the network connection to the customer site, a more detailed 
analysis of a site's performance may be performed. 

10 In the foregoing specification, the invention has been described with 

reference to specific exemplary embodiments thereof. It will, however, be 
evident that various modifications and changes may be made thereto without 
departing from the broader spirit and scope of the invention as set forth in the 
appended claims. The specification and drawings are, accordingly, to be 

15 regarded in an illustrative rather than a restrictive sense. 
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CLAIMS 

What is claimed is: 



1 LA system, comprising: 

2 an intranetwork; 

3 an extranetwork coupled to the intranetwork; 

4 a first host digital processing system coupled to the intranetwork, 

5 the first digital processing system having performance parameters; and 

6 a first remote digital processing system coupled to the 

7 extranetwork to monitor a performance parameter, the first remote digital 

8 processing system coupled to the extranetwork at a first location similar to 

9 that of a first expected user of the first host digital processing system. 

1 2. The system of claim 1, wherein the extranetwork comprises a first 

2 backbone network and wherein the first remote digital processing system 

3 is coupled to the first backbone network. 

1 3. The system of claim 2, further comprising a second remote digital 

2 processing system to monitor a performance parameter of the first host 

3 digital processing system, wherein the extranetwork further comprises a 

4 second backbone network and wherein the second remote digital 

5 processing system is coupled to the second backbone network at a second 

6 location similar to that of a second expected user of the second host digital 

7 processing system. 
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1 4. The system of claim 2, further comprising a monitoring operations 

2 center coupled to the extranetwork, the monitoring operations center to 

3 receive data from the first remote digital processing system. 

1 5. The system of claim 4, wherein the data includes the performance 

2 parameter. 

1 6. The system of claim 5, further comprising a second extranetwork 

2 coupled to the first remote digital processing system and the monitoring 

3 operations center, the second extranetwork to transmit the data from the 

4 first remote digital processing system to the monitoring operations center. 

1 7. The system of claim 6, wherein the second extranetwork is a public 

2 switched telephone network. 

1 8. The system of claim 6, wherein the second extranetwork is a 

2 wireless network. 

1 9. The system of claim 1, wherein the first remote digital processing 

2 system is configured to pre-set cookies on the host digital processing 

3 system. 

1 10. The system of claim 9, wherein the host digital processing system 

2 includes a plurality of web pages and wherein the pre-set cookies enable 

3 the first remote digital processing system to access a particular one of the 

4 plurality of web pages independent of another of the plurality of web 

5 pages. 
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1 1L The system of claim 1, wherein the performance parameter is a 

2 timing threshold parameter. 

1 12. The system of claim 11, wherein the timing threshold parameter is 

2 a domain name system lookup time. 

1 13. The system of claim 11, wherein the timing threshold parameter is 

2 a connect time. 

1 14. The system of claim 11, wherein the timing threshold parameter is 

2 throughput. 

1 15. The system of claim 11, wherein the timing threshold parameter is 

2 a transfer rate. 

1 16. The system of claim 11, wherein the timing threshold parameter is 

2 latency. 

1 17. The system of claim 1, wherein the performance parameter is a link 

2 verification. 

1 18. The system of claim 1, wherein the performance parameter is a 

2 subsidiary page verification. 

1 19. The system of claim 4, wherein the first remote digital processing 

2 system includes a queuing client to control the transfer of data to the 

3 monitoring operations center. 

1 20. A method of network monitoring, comprising: 
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2 positioning a remote digital processing system on a backbone 

3 network remotely from a host digital processing system, the remote 

4 digital processing system position approximate that of an expected user of 

5 the host digital processing system, the host digital system coupled to the 

6 backbone network through an intranetwork; and 

7 monitoring a performance parameter of the host digital processing 

8 system with the remote digital processing system. 

1 21 . The method of claim 20, further comprising transmitting 

2 information about the performance parameter to a monitoring operations 

3 center. 

1 22. A method of claim 20, wherein monitoring comprises: 

2 determining the performance parameter for monitoring; 

3 establishing a connection with the host digital processing system; 

4 and 

5 performing a transaction with the host digital processing system. 

1 23. The method of claim 22, wherein determining comprises receiving 

2 the performance parameter through a configuration interface. 

1 24. The method of claim 22, wherein establishing comprises pre-setting 

2 cookies on the host digital processing system to enable the remote digital 

3 processing system to access data on the host digital processing system. 

1 25. The method of claim 22, wherein the performance parameter is a 

2 timing parameter associated with the transaction and wherein the method 

3 further comprises measuring the timing parameter. 
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1 26. The method of claim 22, wherein the performance parameter is a 

2 domain name server lookup time associated with establishing the 

3 connection. 

1 27. The method of claim 25, wherein measuring comprises calculating 

2 a latency time. 

1 28. The method of claim 25, wherein measuring comprises calculating 

2 a throughput time. 

1 29. The method of claim 25, wherein measuring comprises calculating 

2 a connection time. 

1 30. The method of claim 25, wherein measuring comprises calculating 

2 a data transfer rate. 

1 31. The method of claim 22, wherein the performance parameter is a 

2 correctness parameter and wherein the method further comprises 

3 evaluating the correctness parameter. 

1 32. The method of claim 31, wherein evaluating comprises: 

2 determining a positive search pattern; 

3 determining a negative search pattern; and 

4 comparing the positive search pattern with the negative search 

5 pattern to verify the correctness of a content. 

1 33. The method of claim 31, wherein evaluating comprises: 

2 fetching an accessory file from a storage location; and 
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3 verifying that content of the accessory file is available for retrieval. 

1 34. The method of claim 31, wherein evaluating comprises: 

2 selecting a link on a web page; and 

3 verifying that content corresponding to the web page is accessible. 

1 35. A method, comprising: 

2 monitoring performance parameters of a host digital processing 

3 system coupled to an extranetwork using a plurality of remote digital 

4 processing systems, the extranetwork comprising a plurality of backbone 

5 networks, at least one of the plurality of remote digital processing systems 

6 selectively coupled to at least one of the plurality of backbone networks at 

7 a position approximate that of an expected user of the host digital 

8 processing system. 

1 36. The method of claim 35, wherein monitoring comprises: 

2 evaluating the performance parameters using one of the plurality 

3 of remote digital processing systems; and 

4 transmitting a report on the evaluating from the one of the 

5 plurality of remote digital processing systems to another of the plurality 

6 of remote digital processing systems. 

1 37. The method of claim 36, wherein evaluating the performance 

2 parameters includes measuring a timing threshold associated with an 

3 interaction with the host digital processing system. 

1 38. An apparatus, comprising: 
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2 means for positioning a remote digital processing system on a 

3 backbone network remotely from a host digital processing system, the 

4 remote digital processing system position approximate that of an expected 

5 user of the host digital processing system, the host digital system coupled 

6 to the backbone network through an intranetwork; and 

7 means for monitoring a performance parameter of the host digital 

8 processing system with the remote digital processing system. 

1 39. The apparatus of claim 38, wherein the means for monitoring 

2 comprises: 

3 means for evaluating the performance parameter; and 

4 means for reporting the evaluation of the performance parameter 

5 to a monitoring operations center. 

1 40. The apparatus of claim 39, wherein the performance parameter is a 

2 timing threshold. 

1 41. The apparatus of claim 39, wherein the performance parameter is a 

2 correctness parameter. 
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ABSTRACT 

A method and apparatus is described for remote monitoring of a business 
site network. One or more remote satellite systems may be strategically 
positioned at different points on the Internet that are close to backbone networks 
5 in order to monitor and evaluate typical user interactions with a business site. 
By positioning the remote satellite systems at points near backbones approximate 
to those of users accessing a business site, a more accurate analysis of a site's 
performance may be performed that better reflects the experience that similarly 
connected users experience. Various network and system parameters of a 
10 business site may be monitored, such as threshold timing parameters and 
correctness parameters. 
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statements were made with the knowledge that willful false statements and the like so made 
are punishable by fine or imprisonment, or both, under Section 1001 of Title 18 of the United 
States Code and that such willful false statements may jeopardize the validity of the 
application or any patent issued thereon. 

Full Name of Sole/First im/ontor David D. Faraldo II _ 

Inventor's Signature prUD-'F^Mj^ Date 13/30^000 



Residence 



£q$t€<l Czrv Citizenship v S A . 



(City/State) (Country) 



Post Office Address ^H<q C vr^Areti Lv - 



Full Name of Second/Joint Inventor . 



Inventor's Signature . . Date ■ 



Residence Citizenship 

(City, State) (Country) 

Post Office Address 



Full Name of Third/Joint Inventor . 



Inventor's Signature Date ■ 



Full Name of Fourth/Joint Inventor. 



Residence . Citizenship 

(City, State) (Country) 

Post Office Address . — . 



Inventor's Signature „ . Date - 



Residence . Citizenship 

(City, State) (Country) 

Post Office Address „ 
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APPENDIX A 



William E. Alford, Reg. No. 37,764; Farzad E. Amini, Reg. No. 42,261; William Thomas Babbitt, Reg. No. 
39,591; Carol F. Barry, Reg. No. 41,600; Jordan Michael Becker, Reg. No. 39,602; Lisa N. Benado, Reg. 
No. 39,995; Bradley J. Bereznak, Reg. No. 33,474; Michael A. Bernadicou, Reg. No. 35,934; Roger W. 
Blakely, Jr., Reg. No. 25,831; R. Alan Burnett, Reg. No. 46,149; Gregory D. Caldwell, Reg. No. 39,926; 
Andrew C. Chen, Reg. No. 43,544; Thomas M. Coester, Reg. No. 39,637; Donna Jo Coningsby, Reg. No. 
41,684; Florin Corie, Reg. No. 46,244; Dennis M. deGuzman, Reg. No. 41,702; Stephen M. De Klerk, 
Reg. No. 46,503; Michael Anthony DeSanctis, Reg. No. 39,957; Daniel M. De Vos, Reg. No. 37,813; 
Sanjeet Dutta, Reg. No. 46,145; Matthew C. Fagan, Reg. No. 37,542; Tarek N. Fahmi, Reg. No. 41,402; 
George Fountain, Reg. No. 37,374; James Y. Go, Reg. No. 40,621 ; James A. Henry, Reg. No. 41 ,064; 
Libby N. Ho, Reg. No. 46,774; Willmore F. Holbrow III, Reg. No. 41,845; Sheryl Sue Holloway, Reg. No. 
37,850; George W Hoover II, Reg. No. 32,992; Eric S, Hyman, Reg. No. 30,139; William W. Kidd, Reg. 
No. 31,772; Sang Hui Kim, Reg. No. 40,450; Walter T. Kim, Reg. No. 42,731; Eric T. King, Reg. No. 
44,188; George Brian Leaveil, Reg. No. 45,436; Kurt P. Leyendecker, Reg. No. 42,799; Gordon R. 
Lindeen III, Reg. No. 33,192; Jan Carol Little, Reg. No. 41,181; Robert G. Litts, Reg. No. 46,876; Joseph 
Lutz, Reg. No. 43,765; Michael J. Mallie, Reg. No. 36,591; Andre L. Marais, under 37 C.F.R. § 10.9(b); 
Paul A. Mendonsa, Reg. No. 42,879; Clive D. Menezes, Reg. No, 45,493; Chun M. Ng, Reg. No. 36,878; 
Thien T. Nguyen, Reg. No. 43,835; Thinh V. Nguyen, Reg. No. 42,034; Dennis A. Nicholls, Reg. No. 
42,036; Robert B. O'Rourke, Reg. No. 46,972; Daniel E. Ovanezian, Reg. No. 41,236; Kenneth B. Paley, 
Reg. No. 38,989; Gregg A. Peacock, Reg. No. 45,001; Marina Portnova, Reg. No. 45,750; William F. 
Ryann, Reg. 44,313; James H. Salter, Reg. No. 35,668; William W. Schaal, Reg. No. 39,018; 
James C. Scheller, Reg. No. 31,195; Jeffrey Sam Smith, Reg. No. 39,377; Maria McCormack Sobrino, 
Reg. No. 31,639; Stanley W. Sokoloff, Reg. No. 25,128; Judith A. Szepesi, Reg. No. 39,393; Vincent P. 
Tassinari, Reg. No. 42,179; Edwin H. Taylor, Reg. No. 25,129; John F. Travis, Reg. No. 43,203; Joseph 
A. Twarowski, Reg. No. 42,191; Tom Van Zandt, Reg, No. 43,219; Lester J. Vincent, Reg. No. 31,460; 
Glenn E. Von Tersch, Reg. No. 41,364; John Patrick Ward, Reg. No. 40,216; Mark L. Watson, Reg. No. 
46,322; Thomas C. Webster, Reg. No. 46,154; and Norman Zafman, Reg. No. 26,250; my patent 
attorneys, and Firasat Ali, Reg. No. 45,715; Justin M. Dillon, Reg. No. 42,486; Thomas S. Ferrill, Reg. No. 
42,532; and Raul Martinez, Reg. No. 46,904, my patent agents, of BLAKELY, SOKOLOFF, TAYLOR & 
ZAFMAN LLP, with offices located at 12400 Wilshire Boulevard, 7th Floor, Los Angeles, California 90025, 
telephone (310) 207-3800, and James R. Thein, Reg. No. 31,710, my patent attorney with full power of 
substitution and revocation, to prosecute this application and to transact all business in the Patent and 
Trademark Office connected herewith. 
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APPENDIX B 

Title 37, Code of Federal Regulations, Section 1.56 
Duty to Disciose information Material to P atentability 

(a) A patent by its very nature is affected with a public interest. The public interest is best served, 
and the most effective patent examination occurs when, at the time an application is being examined, the 
Office is aware of and evaluates the teachings of all information material to patentability. Each individual 
associated with the filing and prosecution of a patent application has a duty of candor and good faith in 
dealing with the Office, which includes a duty to disclose to the Office all information known to that individual 
to be material to patentability as defined in this section. The duty to disclosure information exists with respect 
to each pending claim until the claim is cancelled or withdrawn from consideration, or the application becomes 
abandoned. Information material to the patentability of a claim that is cancelled or withdrawn from 
consideration need not be submitted if the information is not material to the patentability of any claim 
remaining under consideration in the application. There is no duty to submit information which is not material 
to the patentability of any existing claim. The duty to disclosure all information known to be material to 
patentability is deemed to be satisfied if all information known to be material to patentability of any claim 
issued in a patent was cited by the Office or submitted to the Office in the manner prescribed by §§1 .97(bMa) 
and 1 98 However, no patent will be granted on an application in connection with which fraud on the Office 
was practiced or attempted or the duty of disclosure was violated through bad faith or intentional misconduct. 
The Office encourages applicants to carefully examine: 

(1 ) Prior art cited in search reports of a foreign patent office in a counterpart application, and 

(2) The closest information over which individuals associated with the filing or prosecution of a 
patent application believe any pending claim patentably defines, to make sure that any material information 
contained therein is disclosed to the Office. 

(b) Under this section, information is material to patentability when it is not cumulative to 
information already of record or being made or record in the application, and 

(1) It establishes, by itself or in combination with other information, a prima facie case of 
unpatentability of a claim; or 

(2) It refutes, or is inconsistent with, a position the applicant takes in: 

(i) Opposing an argument of unpatentability relied on by the Office, or 

(ti) Asserting an argument of patentability. 

A prima facie case of unpatentability is established when the information compels a conclusion that a claim is 
unpatentable under the preponderance of evidence, burden-of-proof standard, giving each term in the claim 
its broadest reasonable construction consistent with the specification, and before any consideration is given to 
evidence which may be submitted in an attempt to establish a contrary conclusion of patentability. 

(c) Individuals associated with the filing or prosecution of a patent application within the 
meaning of this section are: 

(1) Each inventor named in the application; 

(2) Each attorney or agent who prepares or prosecutes the application; and 

(3) Every other person who is substantively involved in the preparation or prosecution of the 
application and who is associated with the inventor, with the assignee or with anyone to whom there is an 
obligation to assign the application. 

(d) Individuals other than the attorney, agent or inventor may comply with this section by 
disclosing information to the attorney, agent, or inventor. 
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